Privacy Policy

We collect information you provide directly to us when you: • Create or modify your account • Request customer support or contact us • Participate in surveys or promotions • Use our AI conversation services The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make and the products and features you use. The personal information we collect can include the following: • Personal Information You Disclose to Us. We collect names; email addresses; phone numbers; and other similar contact data. • Credentials. We collect passwords, password hints, and similar security information used for authentication and account access. • Conversation Data. We collect and process your conversations with our AI agents to provide personalized mental health support. All personal information that you provide to us must be true, complete and accurate, and you must notify us of any changes to such personal information.

We use personal information collected via our Services for a variety of business purposes described below. We process your personal information for these purposes in reliance on our legitimate business interests, in order to enter into or perform a contract with you, with your consent, and/or for compliance with our legal obligations. We use the information we collect or receive: • To facilitate account creation and logon process • To provide, maintain, and improve our AI mental health services • To send administrative information to you regarding our services • To fulfill and manage your orders, payments, and transactions • To respond to your inquiries and offer customer support • To train and improve our AI models for better mental health support • To enforce our terms, conditions and policies for business purposes • To comply with legal obligations We do not sell, trade, or rent your personal information to third parties.

We may process or share your data that we hold based on the following legal basis: • Consent: We may process your data if you have given us specific consent to use your personal information for a specific purpose. • Legitimate Interests: We may process your data when it is reasonably necessary to achieve our legitimate business interests. • Performance of a Contract: Where we have entered into a contract with you, we may process your personal information to fulfill the terms of our contract. • Legal Obligations: We may disclose your information where we are legally required to do so in order to comply with applicable law, governmental requests, a judicial proceeding, court order, or legal process. • Vital Interests: We may disclose your information where we believe it is necessary to investigate, prevent, or take action regarding potential violations of our policies, suspected fraud, situations involving potential threats to the safety of any person and illegal activities. More specifically, we may need to process your data or share your personal information in the following situations: • Vendors, Consultants and Other Third-Party Service Providers. We may share your data with third party vendors, service providers, contractors or agents who perform services for us or on our behalf and require access to such information to do that work. • Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. Our security measures include: • Encryption of data in transit and at rest • Regular security assessments and monitoring • Access controls and multi-factor authentication • Employee training on data protection and security protocols • Secure data centers with physical access controls Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

We may use cookies and similar tracking technologies (like web beacons and pixels) to access or store information. Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Policy. The cookies we use help us to: • Keep you signed in to your account • Remember your preferences and settings • Understand how you use our services • Improve our platform performance • Provide personalized AI responses You can control cookies through your browser settings and choose to disable them, though this may affect the functionality of our Services.

We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy policy, unless a longer retention period is required or permitted by law. Specifically: • Account information: Until you delete your account or request deletion • Conversation data: As long as you maintain your account, unless you delete specific conversations • Analytics data: Up to 2 years in anonymized form • Support communications: Up to 3 years for quality assurance When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

In some regions (like the European Economic Area), you have certain rights under applicable data protection laws. These may include the right to: • Request access and obtain a copy of your personal information • Request rectification or erasure of your personal information • Restrict the processing of your personal information • If applicable, data portability • Object to the processing of your personal information If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your local data protection supervisory authority. To exercise these rights, please contact us at privacy@noyco.com. We will consider and act upon any request in accordance with applicable data protection laws.

We do not knowingly solicit data from or market to children under 18 years of age. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at privacy@noyco.com.

We may update this privacy policy from time to time. The updated version will be indicated by an updated "Revised" date and the updated version will be effective as soon as it is accessible. If we make material changes to this privacy policy, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy policy frequently to be informed of how we are protecting your information.

If you have questions or comments about this policy, or if you would like to review, update, or delete the data we collect from you, please contact us at: Email: <a href="mailto:privacy@noyco.com">privacy@noyco.com</a> We will respond to your inquiries within 30 days and work with you to address any concerns you may have about our privacy practices.